Unencrypted Tire Sensors Expose Millions of Vehicles to Covert Tracking

Researchers in Europe have uncovered a significant privacy vulnerability in Tire Pressure Monitoring Systems (TPMS), a mandatory safety feature in all passenger vehicles sold in the United States since the late 2000s. These systems, designed to relay real-time tire pressure data, broadcast unencrypted, unique identifiers that can be captured and analyzed using inexpensive equipment, potentially enabling widespread vehicle tracking. Scientists from the IMDEA Networks Institute, collaborating with European partners, demonstrated that these signals allow for the reconstruction of vehicle travel patterns and daily routines, posing a new challenge to personal privacy.

The team utilized a low-cost radio receiver, costing approximately $100, to intercept signals from over 20,000 vehicles within a 10-week period. By deploying multiple receivers, researchers could track individual vehicles and infer their movements, even through walls and from moving cars inside buildings. This method of surveillance differs from traditional camera-based tracking as it relies on a vehicle's electronic signature rather than visual identification like license plates, making it more difficult to detect.

Experts emphasize that while TPMS was implemented for safety following the TREAD Act of 2000, its design did not account for security implications. The unencrypted nature of the transmissions allows for passive data collection that, when aggregated, can become a powerful identifier for surveillance. Researchers are urging manufacturers and regulators to address this vulnerability by incorporating stronger security measures into future vehicle sensor systems, highlighting the need for privacy considerations in increasingly connected automotive technologies.